In quantum communication, two parties exchange information encoded in quantum states. Typically, the quantum states are specially defined properties of photons such as pairs of polarization states (e.g., 0° and 90°, or 45° and 135°) or circular basis states (e.g., left-handedness and right-handedness). Through the quantum communication (“QC”), the two parties produce a shared random series of bits known only to them, which can then be used as secret keys in subsequent encryption and decryption of messages. The process of producing such keys through QC is also called quantum key distribution (“QKD”).
A third party can, in theory, eavesdrop on the QC between the two parties. Such eavesdropping perturbs the QC, however, introducing anomalies that the two intended parties can detect. Using conventional communication, the two parties post-process the results of the QC to remove any partial information acquired by an eavesdropper, and form shared secret keys from the remaining information resulting from the QC.
For example, according to one general approach to QKD, a transmitter sets the quantum state of binary information, makes a record of how it set the quantum state, and transmits the information. Table 1 shows an example of quantum states and bases for different polarizations of photons. For the bases and states shown in Table 1, the transmitter selects a basis (rectilinear or diagonal), sets the polarization state for a photon in the selected basis, and records the bit value (0 or 1), the selected sending basis and the time of transmission.
TABLE 1Example bases and quantum states.Basis01Rectilinear (+)90° 0°Diagonal (×)45°135° (or −45°)
A receiver receives the binary information, measures the quantum state of the information and makes a record of how it measured the quantum state. The measured state depends on how the receiver performs the measurement (e.g., with measuring basis of rectilinear or diagonal). The transmitter and receiver are expected to record different bit values in some instances because the transmitter and receiver at times set/measure the quantum-state-encoded information in different ways. Thus, after exchanging information in quantum states, the transmitter and receiver compare their records of how the quantum states were set and measured. For this comparison, the transmitter and receiver exchange information over a public channel. Then, the transmitter and receiver produce a shared series of bits (keys) from the encoded information for which quantum states were set and measured in the same way by the transmitter and receiver.
For the bases and states shown in Table 1, for example, the receiver selects a basis (rectilinear or diagonal), measures the polarization state in the selected basis, and records the measured bit value and measuring basis. No possible measuring basis can distinguish all four states, so the receiver essentially guesses either rectilinear or diagonal. If the measuring basis happens to match the sending basis, the receiver should measure the correct bit value. If the measuring basis does not match the sending basis, however, the measured bit value is as likely to be correct as incorrect. For example, if the sending basis is diagonal for the bit value 0 (polarization state of 45°) but the measuring basis is rectilinear, the measured bit values of 0 (90°) and 1 (0°) are equally likely. The transmitter and receiver compare the sending basis and measuring basis for a given photon, and keep the bit value for a photon if the sending basis and measuring basis match.
If an eavesdropper intercepts and measures a photon, the measurement perturbs the quantum state of the photon. The eavesdropper can only guess the original sending basis when it re-encodes and re-transmits the photon to the intended destination. At the time of measurement by the receiver, the eavesdropping is not detected. Instead, for subsets of the bit values for which sending basis and measuring basis are found to match, the transmitter and receiver compare parity values. The parity values should match exactly, if the system is appropriately tuned and free from imperfections in transmission and reception. Eavesdropping introduces noticeable discrepancies in the bit values, which allows the transmitter and receiver to detect the eavesdropping, correct the keys, and establish an upper limit on the eavesdropper's partial information.
An error-free bit string shared by the transmitter and receiver can then be privacy-amplified (e.g., by hashing with a hashing function) to reduce its length. (Or, bits can simply be dropped, but this lacks advantages of privacy amplification.) The final length of the shared bit string can depend on the number of errors detected. Shortening the shared bit string with privacy amplification reduces knowledge an eavesdropper might have to an arbitrarily low level—typically, much less than a single bit.
Other approaches to QC exploit other quantum properties (e.g., quantum entanglement) to exchange information encoded in quantum states. In addition, techniques such as privacy amplification can be used to eliminate the partial information that an eavesdropper can acquire. Techniques such as information reconciliation can be used to resolve small discrepancies in the shared bit values of the transmitter and receiver.
The theoretical framework for QC has been established for over 25 years, and its advantages in terms of security of keys are well accepted. Over the past two decades, implementations of QKD systems have become cheaper, more reliable, easier to maintain (e.g., self-tuning, self-checking), and easier to use. Even so, compared to other security solutions, QKD system have tended to be expensive and difficult to deploy. A typical QKD system is large and operates only in point-to-point mode over a fiber connection between transmitter and receiver. Several commercially available QKD systems perform QKD only over point-to-point links, are not portable, and require a dedicated fiber connection. Moreover, their QC cannot co-exist with network traffic. Smaller footprint, less expensive devices for QKD have recently been developed, which can engage in QC over the same channel as regular network traffic, and which can be used in conjunction with protocols for secure multi-party communication. These advances may help QKD gain a commercial foothold. Such QKD devices and technologies are not integrated with existing architectures for public key infrastructure, however, which may hinder their adoption.
A Public Key Infrastructure (“PKI”) is a set of hardware, software, people, policies, and procedures used to create, manage, distribute, use, store, and revoke digital certificates. PKI is one of the fundamental building blocks of security on the Internet, and is used extensively for commercial sales, banking, communications and military systems. In a PKI, public keys are associated with user identities by means of a certificate authority. A user identity is unique within each certificate authority domain. Through a registration and issuance process, a certificate authority binds public keys with user identities, respectively. Depending on the level of assurance the binding has, the registration and issuance process may be carried out by software at a certificate authority or under human supervision. The registration authority is the entity in the PKI whose role is to assure and validate the binding. For a given user, the user identity, the public key, their binding, validity conditions and other attributes are made unforgeable in public key certificates issued by the certificate authority. Establishing a PKI and populating the user identities, public keys, certificates, etc. can involve considerable cost and effort, as well as the establishment of appropriate standards.
Current PKI systems typically use asymmetric cryptographic protocols such as RSA, El Gamal, elliptic curve cryptography and Diffie-Hellman for digital signatures and key exchange. These methods for digital signatures and key exchange are vulnerable to future advances that exploit increased computing power (e.g., a future quantum computer running Shor's algorithm) or flaws discovered in key generation algorithms. Even though such threats have not yet materialized, their possibility cannot be ruled out, which shows a potential retroactive vulnerability in today's secure communications.